In Nautilus under Ubuntu 12.04, I accidentally selected several directories on a partition and deleted them at once (unfortunately, I deleted them by Shift+Delete such that they don't remain in Trash). I haven't written any new data to that partition yet since the deletion. I wonder what ways I can try to recover them? Note that the partition is NTFS, shared between Windows 7 and Ubuntu 12.04.

Following is different software that I have tried so far.

  1. I have also tried to use Sleuthkit, but I cannot figure out how to use it.

    I have been running sudo fls -f ntfs -d -r -p /dev/sda3 > ~/deleted_files.txt for almost a week on my 110GB 96%-used ntfs partition. It hasn't finished running yet (don't know when it will), and the file ~/deleted_files.txt is still empty. All my work has been stalled since I don't dare to write any data to the partition.

    Now I wonder if my usage of sleuthkit is the quickest way to identify most recently deleted directories and files in my case?

  2. I installed TestDisk 6.13 via apt-get install, and followed http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk to recover the deleted directories and the files in them. But what is shown by TestDisk is not the deleted file/directory names as shown in the picture in the link, but files named by inode numbers:

    TestDisk 6.13, Data Recovery Utility, November 2011
    Christophe GRENIER <grenier@cgsecurity.org>
     3 P HPFS - NTFS           9291  38 28 23650 187 25  230686720 [Data]
    Deleted files
    >inode_13285                           30-Jan-2011 20:55     29427
     inode_13285:Zone.Identifier           30-Jan-2011 20:55        26
     inode_164258                          11-Aug-2011 13:16      2993
     inode_307016                          12-Feb-2011 09:34      1808
     inode_307017                          12-Feb-2011 09:34     10254
     inode_307018                          12-Feb-2011 09:34     13155
     inode_307019                          12-Feb-2011 09:34      7586
     inode_307020                          12-Feb-2011 09:34      7344
     inode_307021                          12-Feb-2011 09:34      6943
     inode_307022                          12-Feb-2011 09:34      6081
     inode_307023                          12-Feb-2011 09:34     24043
     inode_314965                          12-Feb-2011 09:36    112947
     inode_314983                          12-Feb-2011 09:36     23581
     inode_314984                          12-Feb-2011 09:36      8486
     inode_314985                          12-Feb-2011 09:36       158
     inode_314986                          12-Feb-2011 09:36        45
    Use : to select the current file, a to select/deselect all files,
        C to copy the selected files, c to copy the current file, q to quit

    When I hit a and then C to select and copy all the selected files, files named inode_xxxxxx will be copied to a directory that I specify.

    Also, I don't know the meaning of the date and time for each file shown by TestDisk. Does it mean the deletion date and time or last update date and time before deletion? (Note the most recent date and time shown by TestDisk is 30-Jul-2012 20:53, which is not today when the accidental deletion happened.)

    How can I figure out which files are my most recently deleted ones, and how can I recover them?

    Can I find out and recover my most recently deleted directories instead of just files?

  3. I am also curious to know if these two links to How-to really work?

    In http://www.ehow.com/how_5202235_retrieve-deleted-files-linux.html, grep -b 'search-text' /dev/partition > file.txt is used to search for the deleted files.

    In http://www.ehow.com/how_7517984_restore-overwritten-file-linux.html, the "Isdel" command is used.

What other software can I try besides TestDisk and Sleuthkit?

  • $ ntfsundelete ? (ntfsprogs)
    – elv
    Aug 23, 2012 at 14:12
  • @elv: It seems that ntfsundelete doesn't support to find deleted files by their deletion time, but only their "altering time", which make it difficult to recover the directories/files deleted at once last time. Correct me if I am wrong.
    – Tim
    Aug 23, 2012 at 15:02
  • 1
    Consider remounting your partition read-only, so that no daemon or other program accidentally writes to the partition for you. Jun 10, 2014 at 6:16
  • When you get out of this mess, if you do. Have a look at revision control tools such as mercurial. You don't want to be in this mess again. Jun 16, 2014 at 21:52

2 Answers 2


If you use fls -r, then it will go recursively through all the directories, which might not be exactly what you need for your goal here. Try using fls in more interactive way, just like ls. Also, using mactime to process output can be helpful to navigate to relevant dirs/files.

mactime puts all files to timeline, marking when each of them was modified (m), accessed (a), (attribute-)changed (c) or born (b). Because files can be born and modified in separate times, you'll see some same filenames on separate lines.

For example, use fls -m X: /dev/sda3 | mactime -b - to get listing of the top directory, sorted in time. Deleted files are marked with (deleted). You'll see also a lot of maintenance data stores which are normally hidden in windows explorer.

In case of NTFS there is a 3-number combination like x-y-z designating file ID in the filesystem. For normal directories, y should be 144.

Use fls -m X: /dev/sda3 x-y-z | mactime -b - to get listing of directory you are interested in.

Recovering is done similarly using file IDs: icat /dev/sda3 x-y-z >recovered_file

  • This is great information! I've missed the menu at the bottom in TestDisk before after selecting my partition and hitting enter. This gave me hope to see my directories still there to press on, and finally circle back to TestDisk. ..since fls is also from the SleuthKit package, I believe this is how TD is working, looping through recovered directories (which are actually also file) and using the tree info to display. I had several screens of files to select and then many more I didnt need.. was lucky desired were on top, but almost wrote script to recover only from single directory.. possible!
    – alchemy
    Apr 30, 2020 at 18:00
  • also, see this answer about using RecupraBit if that doesnt work unix.stackexchange.com/a/283009/346155
    – alchemy
    Apr 30, 2020 at 18:12

Data recovery tools in Linux are very weird and rare in between even more that works on NTFS filesystems. So, if you want a tool that recovers the meta-data of the file and present them, if it's not one of the proposed, ntfsundelete, PhotoRec (Sleuthkit) or TestDisk; I would recommend using Windows-only tools for the task.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.